<!DOCTYPE html>
<html lang="en-us">
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    
<meta charset="UTF-8">
<title>精确值查找 | Elasticsearch: 权威指南 | Elastic</title>
<link rel="home" href="index.html" title="Elasticsearch: 权威指南">
<link rel="up" href="structured-search.html" title="结构化搜索">
<link rel="prev" href="structured-search.html" title="结构化搜索">
<link rel="next" href="combining-filters.html" title="组合过滤器">
<meta name="DC.type" content="Learn/Docs/Elasticsearch/Definitive Guide">
<meta name="DC.subject" content="Elasticsearch">
<meta name="DC.identifier" content="2.x">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script src="https://cdn.optimizely.com/js/18132920325.js"></script>
    <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
    <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
    <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
    <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
    <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
    <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
    <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
    <link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
    <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
    <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
    <link rel="manifest" href="/manifest.json">
    <meta name="apple-mobile-web-app-title" content="Elastic">
    <meta name="application-name" content="Elastic">
    <meta name="msapplication-TileColor" content="#ffffff">
    <meta name="msapplication-TileImage" content="/mstile-144x144.png">
    <meta name="theme-color" content="#ffffff">
    <meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd">
    <meta name="yandex-verification" content="d8a47e95d0972434">
    <meta name="localized" content="true">
    <meta name="st:robots" content="follow,index">
    <meta property="og:image" content="https://www.elastic.co/static/images/elastic-logo-200.png">
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
    <link rel="icon" href="/favicon.ico" type="image/x-icon">
    <link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
    <link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
    <link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
    <link rel="stylesheet" type="text/css" href="/guide/static/styles.css">
  </head>

  <!--© 2015-2021 Elasticsearch B.V. Copying, publishing and/or distributing without written permission is strictly prohibited.-->

  <body>
    <!-- Google Tag Manager -->
    <script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
    <!-- End Google Tag Manager -->

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-12395217-16');
    </script>

    <!--BEGIN QUALTRICS WEBSITE FEEDBACK SNIPPET-->
    <script type="text/javascript">
      (function(){var g=function(e,h,f,g){
      this.get=function(a){for(var a=a+"=",c=document.cookie.split(";"),b=0,e=c.length;b<e;b++){for(var d=c[b];" "==d.charAt(0);)d=d.substring(1,d.length);if(0==d.indexOf(a))return d.substring(a.length,d.length)}return null};
      this.set=function(a,c){var b="",b=new Date;b.setTime(b.getTime()+6048E5);b="; expires="+b.toGMTString();document.cookie=a+"="+c+b+"; path=/; "};
      this.check=function(){var a=this.get(f);if(a)a=a.split(":");else if(100!=e)"v"==h&&(e=Math.random()>=e/100?0:100),a=[h,e,0],this.set(f,a.join(":"));else return!0;var c=a[1];if(100==c)return!0;switch(a[0]){case "v":return!1;case "r":return c=a[2]%Math.floor(100/c),a[2]++,this.set(f,a.join(":")),!c}return!0};
      this.go=function(){if(this.check()){var a=document.createElement("script");a.type="text/javascript";a.src=g;document.body&&document.body.appendChild(a)}};
      this.start=function(){var a=this;window.addEventListener?window.addEventListener("load",function(){a.go()},!1):window.attachEvent&&window.attachEvent("onload",function(){a.go()})}};
      try{(new g(100,"r","QSI_S_ZN_emkP0oSe9Qrn7kF","https://znemkp0ose9qrn7kf-elastic.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_emkP0oSe9Qrn7kF")).start()}catch(i){}})();
    </script><div id="ZN_emkP0oSe9Qrn7kF"><!--DO NOT REMOVE-CONTENTS PLACED HERE--></div>
    <!--END WEBSITE FEEDBACK SNIPPET-->

    <div id="elastic-nav" style="display:none;"></div>
    <script src="https://www.elastic.co/elastic-nav.js"></script>

    <!-- Subnav -->
    <div>
      <div>
        <div class="tertiary-nav d-none d-md-block">
          <div class="container">
            <div class="p-t-b-15 d-flex justify-content-between nav-container">
              <div class="breadcrum-wrapper"><span><a href="/guide/" style="font-size: 14px; font-weight: 600; color: #000;">Docs</a></span></div>
            </div>
          </div>
        </div>
      </div>
    </div>

    <div class="main-container">
      <section id="content">
        <div class="content-wrapper">

          <section id="guide" lang="zh_cn">
            <div class="container">
              <div class="row">
                <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                  <!-- start body -->
                  <div class="page_header">
<b>请注意:</b><br>本书基于 Elasticsearch 2.x 版本，有些内容可能已经过时。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch: 权威指南</a></span>
»
<span class="breadcrumb-link"><a href="search-in-depth.html">深入搜索</a></span>
»
<span class="breadcrumb-link"><a href="structured-search.html">结构化搜索</a></span>
»
<span class="breadcrumb-node">精确值查找</span>
</div>
<div class="navheader">
<span class="prev">
<a href="structured-search.html">« 结构化搜索</a>
</span>
<span class="next">
<a href="combining-filters.html">组合过滤器 »</a>
</span>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="_finding_exact_values"></a>精确值查找<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elasticsearch-cn/elasticsearch-definitive-guide/edit/cn/080_Structured_Search/05_term.asciidoc">edit</a>
</h2>
</div></div></div>
<p>当进行精确值查找时， 我们会使用过滤器（filters）。过滤器很重要，因为它们执行速度非常快，不会计算相关度（直接跳过了整个评分阶段）而且很容易被缓存。我们会在本章后面的 <a class="xref" href="filter-caching.html" title="关于缓存">过滤器缓存</a> 中讨论过滤器的性能优势，不过现在只要记住：请尽可能多的使用过滤式查询。</p>
<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="_term_查询数字"></a>term 查询数字<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elasticsearch-cn/elasticsearch-definitive-guide/edit/cn/080_Structured_Search/05_term.asciidoc">edit</a>
</h3>
</div></div></div>
<p>我们首先来看最为常用的 <code class="literal">term</code> 查询，
可以用它处理数字（numbers）、布尔值（Booleans）、日期（dates）以及文本（text）。</p>
<pre class="literallayout">让我们以下面的例子开始介绍，创建并索引一些表示产品的文档，文档里有字段 `price` 和 `productID` （ `价格` 和 `产品ID` ）：</pre>

<div class="pre_wrapper lang-sense">
<pre class="programlisting prettyprint lang-sense">POST /my_store/products/_bulk
{ "index": { "_id": 1 }}
{ "price" : 10, "productID" : "XHDK-A-1293-#fJ3" }
{ "index": { "_id": 2 }}
{ "price" : 20, "productID" : "KDKE-B-9947-#kL5" }
{ "index": { "_id": 3 }}
{ "price" : 30, "productID" : "JODL-X-1937-#pV7" }
{ "index": { "_id": 4 }}
{ "price" : 30, "productID" : "QQPX-R-3956-#aD8" }</pre>
</div>
<div class="sense_widget" data-snippet="snippets/080_Structured_Search/05_Term_number.json"></div>
<p>我们想要做的是查找具有某个价格的所有产品，有关系数据库背景的人肯定熟悉 SQL，如果我们将其用 SQL 形式表达，会是下面这样：</p>
<div class="pre_wrapper lang-sql">
<pre class="programlisting prettyprint lang-sql">SELECT document
FROM   products
WHERE  price = 20</pre>
</div>
<p>在 Elasticsearch 的查询表达式（query DSL）中，我们可以使用 <code class="literal">term</code> 查询达到相同的目的。 <code class="literal">term</code> 查询会查找我们指定的精确值。作为其本身， <code class="literal">term</code> 查询是简单的。它接受一个字段名以及我们希望查找的数值：</p>
<div class="pre_wrapper lang-js">
<pre class="programlisting prettyprint lang-js">{
    "term" : {
        "price" : 20
    }
}</pre>
</div>
<p>通常当查找一个精确值的时候，我们不希望对查询进行评分计算。只希望对文档进行包括或排除的计算，所以我们会使用 <code class="literal">constant_score</code> 查询以非评分模式来执行 <code class="literal">term</code> 查询并以一作为统一评分。</p>
<p>最终组合的结果是一个 <code class="literal">constant_score</code> 查询，它包含一个 <code class="literal">term</code> 查询：</p>
<div class="pre_wrapper lang-sense">
<pre class="programlisting prettyprint lang-sense">GET /my_store/products/_search
{
    "query" : {
        "constant_score" : { <a id="CO42-1"></a><i class="conum" data-value="1"></i>
            "filter" : {
                "term" : { <a id="CO42-2"></a><i class="conum" data-value="2"></i>
                    "price" : 20
                }
            }
        }
    }
}</pre>
</div>
<div class="sense_widget" data-snippet="snippets/080_Structured_Search/05_Term_number.json"></div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO42-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>我们用 <code class="literal">constant_score</code> 将 <code class="literal">term</code> 查询转化成为过滤器</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO42-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>我们之前看到过的 <code class="literal">term</code> 查询</p>
</td>
</tr>
</table>
</div>
<p>执行后，这个查询所搜索到的结果与我们期望的一致：只有文档 2 命中并作为结果返回（因为只有 <code class="literal">2</code> 的价格是 <code class="literal">20</code> ）:</p>
<div class="pre_wrapper lang-json">
<pre class="programlisting prettyprint lang-json">"hits" : [
    {
        "_index" : "my_store",
        "_type" :  "products",
        "_id" :    "2",
        "_score" : 1.0, <a id="CO43-1"></a><i class="conum" data-value="1"></i>
        "_source" : {
          "price" :     20,
          "productID" : "KDKE-B-9947-#kL5"
        }
    }
]</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO43-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>查询置于 <code class="literal">filter</code> 语句内不进行评分或相关度的计算，所以所有的结果都会返回一个默认评分 <code class="literal">1</code> 。</p>
</td>
</tr>
</table>
</div>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="_term_查询文本"></a>term 查询文本<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elasticsearch-cn/elasticsearch-definitive-guide/edit/cn/080_Structured_Search/05_term.asciidoc">edit</a>
</h3>
</div></div></div>
<p>如本部分开始处提到过的一样 ，使用 <code class="literal">term</code> 查询匹配字符串和匹配数字一样容易。如果我们想要查询某个具体 UPC ID 的产品，使用 SQL 表达式会是如下这样：</p>
<div class="pre_wrapper lang-sql">
<pre class="programlisting prettyprint lang-sql">SELECT product
FROM   products
WHERE  productID = "XHDK-A-1293-#fJ3"</pre>
</div>
<p>转换成查询表达式（query DSL），同样使用 <code class="literal">term</code> 查询，形式如下：</p>
<div class="pre_wrapper lang-sense">
<pre class="programlisting prettyprint lang-sense">GET /my_store/products/_search
{
    "query" : {
        "constant_score" : {
            "filter" : {
                "term" : {
                    "productID" : "XHDK-A-1293-#fJ3"
                }
            }
        }
    }
}</pre>
</div>
<div class="sense_widget" data-snippet="snippets/080_Structured_Search/05_Term_text.json"></div>
<p>但这里有个小问题：我们无法获得期望的结果。为什么呢？问题不在 <code class="literal">term</code> 查询，而在于索引数据的方式。  如果我们使用 <code class="literal">analyze</code> API (<a class="xref" href="analysis-intro.html#analyze-api" title="测试分析器">分析 API</a>)，我们可以看到这里的 UPC 码被拆分成多个更小的 token ：</p>
<div class="pre_wrapper lang-sense">
<pre class="programlisting prettyprint lang-sense">GET /my_store/_analyze
{
  "field": "productID",
  "text": "XHDK-A-1293-#fJ3"
}</pre>
</div>
<div class="sense_widget" data-snippet="snippets/080_Structured_Search/05_Term_text.json"></div>
<div class="pre_wrapper lang-sense">
<pre class="programlisting prettyprint lang-sense">{
  "tokens" : [ {
    "token" :        "xhdk",
    "start_offset" : 0,
    "end_offset" :   4,
    "type" :         "&lt;ALPHANUM&gt;",
    "position" :     1
  }, {
    "token" :        "a",
    "start_offset" : 5,
    "end_offset" :   6,
    "type" :         "&lt;ALPHANUM&gt;",
    "position" :     2
  }, {
    "token" :        "1293",
    "start_offset" : 7,
    "end_offset" :   11,
    "type" :         "&lt;NUM&gt;",
    "position" :     3
  }, {
    "token" :        "fj3",
    "start_offset" : 13,
    "end_offset" :   16,
    "type" :         "&lt;ALPHANUM&gt;",
    "position" :     4
  } ]
}</pre>
</div>
<div class="sense_widget" data-snippet="snippets/080_Structured_Search/05_Term_text.json"></div>
<p>这里有几点需要注意：</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
Elasticsearch 用 4 个不同的 token 而不是单个 token 来表示这个 UPC 。
</li>
<li class="listitem">
所有字母都是小写的。
</li>
<li class="listitem">
丢失了连字符和哈希符（ <code class="literal">#</code> ）。
</li>
</ul>
</div>
<p>所以当我们用 <code class="literal">term</code> 查询查找精确值 <code class="literal">XHDK-A-1293-#fJ3</code> 的时候，找不到任何文档，因为它并不在我们的倒排索引中，正如前面呈现出的分析结果，索引里有四个 token 。</p>
<p>显然这种对 ID 码或其他任何精确值的处理方式并不是我们想要的。</p>
<p>为了避免这种问题，我们需要告诉 Elasticsearch 该字段具有精确值，要将其设置成 <code class="literal">not_analyzed</code> 无需分析的。 我们可以在 <a class="xref" href="mapping-intro.html#custom-field-mappings" title="自定义域映射">自定义字段映射</a> 中查看它的用法。为了修正搜索结果，我们需要首先删除旧索引（因为它的映射不再正确）然后创建一个能正确映射的新索引：</p>
<div class="pre_wrapper lang-sense">
<pre class="programlisting prettyprint lang-sense">DELETE /my_store <a id="CO44-1"></a><i class="conum" data-value="1"></i>

PUT /my_store <a id="CO44-2"></a><i class="conum" data-value="2"></i>
{
    "mappings" : {
        "products" : {
            "properties" : {
                "productID" : {
                    "type" : "string",
                    "index" : "not_analyzed" <a id="CO44-3"></a><i class="conum" data-value="3"></i>
                }
            }
        }
    }

}</pre>
</div>
<div class="sense_widget" data-snippet="snippets/080_Structured_Search/05_Term_text.json"></div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO44-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>删除索引是必须的，因为我们不能更新已存在的映射。</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO44-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>在索引被删除后，我们可以创建新的索引并为其指定自定义映射。</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO44-3"><i class="conum" data-value="3"></i></a></p>
</td>
<td align="left" valign="top">
<p>这里我们告诉 Elasticsearch ，我们不想对 <code class="literal">productID</code> 做任何分析。</p>
</td>
</tr>
</table>
</div>
<p>现在我们可以为文档重建索引：</p>
<div class="pre_wrapper lang-sense">
<pre class="programlisting prettyprint lang-sense">POST /my_store/products/_bulk
{ "index": { "_id": 1 }}
{ "price" : 10, "productID" : "XHDK-A-1293-#fJ3" }
{ "index": { "_id": 2 }}
{ "price" : 20, "productID" : "KDKE-B-9947-#kL5" }
{ "index": { "_id": 3 }}
{ "price" : 30, "productID" : "JODL-X-1937-#pV7" }
{ "index": { "_id": 4 }}
{ "price" : 30, "productID" : "QQPX-R-3956-#aD8" }</pre>
</div>
<div class="sense_widget" data-snippet="snippets/080_Structured_Search/05_Term_text.json"></div>
<p>此时， <code class="literal">term</code> 查询就能搜索到我们想要的结果，让我们再次搜索新索引过的数据（注意，查询和过滤并没有发生任何改变，改变的是数据映射的方式）：</p>
<div class="pre_wrapper lang-sense">
<pre class="programlisting prettyprint lang-sense">GET /my_store/products/_search
{
    "query" : {
        "constant_score" : {
            "filter" : {
                "term" : {
                    "productID" : "XHDK-A-1293-#fJ3"
                }
            }
        }
    }
}</pre>
</div>
<div class="sense_widget" data-snippet="snippets/080_Structured_Search/05_Term_text.json"></div>
<p>因为 <code class="literal">productID</code> 字段是未分析过的， <code class="literal">term</code> 查询不会对其做任何分析，查询会进行精确查找并返回文档 1 。成功！</p>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="_internal_filter_operation"></a>内部过滤器的操作<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elasticsearch-cn/elasticsearch-definitive-guide/edit/cn/080_Structured_Search/05_term.asciidoc">edit</a>
</h3>
</div></div></div>
<p>在内部，Elasticsearch
会在运行非评分查询的时执行多个操作：</p>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
<p><em>查找匹配文档</em>.</p>
<p><code class="literal">term</code> 查询在倒排索引中查找 <code class="literal">XHDK-A-1293-#fJ3</code> 然后获取包含该 term 的所有文档。本例中，只有文档 1 满足我们要求。</p>
</li>
<li class="listitem">
<p><em>创建 bitset</em>.</p>
<p>过滤器会创建一个 <em>bitset</em> （一个包含 0 和 1 的数组），它描述了哪个文档会包含该 term 。匹配文档的标志位是 1 。本例中，bitset 的值为 <code class="literal">[1,0,0,0]</code> 。在内部，它表示成一个 <a href="/blog/frame-of-reference-and-roaring-bitmaps" class="ulink" target="_top">"roaring bitmap"</a>，可以同时对稀疏或密集的集合进行高效编码。</p>
</li>
<li class="listitem">
<p><em>迭代 bitset(s)</em></p>
<p>一旦为每个查询生成了 bitsets ，Elasticsearch 就会循环迭代 bitsets 从而找到满足所有过滤条件的匹配文档的集合。执行顺序是启发式的，但一般来说先迭代稀疏的 bitset （因为它可以排除掉大量的文档）。</p>
</li>
<li class="listitem">
<p><em>增量使用计数</em>.</p>
<p>Elasticsearch 能够缓存非评分查询从而获取更快的访问，但是它也会不太聪明地缓存一些使用极少的东西。非评分计算因为倒排索引已经足够快了，所以我们只想缓存那些我们 <em>知道</em> 在将来会被再次使用的查询，以避免资源的浪费。</p>
<p>为了实现以上设想，Elasticsearch 会为每个索引跟踪保留查询使用的历史状态。如果查询在最近的 256 次查询中会被用到，那么它就会被缓存到内存中。当 bitset 被缓存后，缓存会在那些低于 10,000 个文档（或少于 3% 的总索引数）的段（segment）中被忽略。这些小的段即将会消失，所以为它们分配缓存是一种浪费。</p>
</li>
</ol>
</div>
<p>实际情况并非如此（执行有它的复杂性，这取决于查询计划是如何重新规划的，有些启发式的算法是基于查询代价的），理论上非评分查询 <em>先于</em> 评分查询执行。非评分查询任务旨在降低那些将对评分查询计算带来更高成本的文档数量，从而达到快速搜索的目的。</p>
<p>从概念上记住非评分计算是首先执行的，这将有助于写出高效又快速的搜索请求。</p>
</div>

</div>
<div class="navfooter">
<span class="prev">
<a href="structured-search.html">« 结构化搜索</a>
</span>
<span class="next">
<a href="combining-filters.html">组合过滤器 »</a>
</span>
</div>
</div>

                  <!-- end body -->
                </div>
                <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                  <div id="rtpcontainer" style="display: block;">
                    <div class="mktg-promo">
                      <h3>Most Popular</h3>
                      <ul class="icons">
                        <li class="icon-elasticsearch-white"><a href="https://www.elastic.co/webinars/getting-started-elasticsearch?baymax=default&amp;elektra=docs&amp;storm=top-video">Get Started with Elasticsearch: Video</a></li>
                        <li class="icon-kibana-white"><a href="https://www.elastic.co/webinars/getting-started-kibana?baymax=default&amp;elektra=docs&amp;storm=top-video">Intro to Kibana: Video</a></li>
                        <li class="icon-logstash-white"><a href="https://www.elastic.co/webinars/introduction-elk-stack?baymax=default&amp;elektra=docs&amp;storm=top-video">ELK for Logs &amp; Metrics: Video</a></li>
                      </ul>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </section>

        </div>


<div id="elastic-footer"></div>
<script src="https://www.elastic.co/elastic-footer.js"></script>
<!-- Footer Section end-->

      </section>
    </div>

<script src="/guide/static/jquery.js"></script>
<script type="text/javascript" src="/guide/static/docs.js"></script>
<script type="text/javascript">
  window.initial_state = {}</script>
  </body>
</html>
